SANS Critical Security Controls Summit London 2013

•Télécharger en tant que PPTX, PDF•

0 j'aime•672 vues

Wolfgang Kandek

Present a hard Target to Attackers

• Open System Administration Channels
• Default and Weak Passwords
• End-user has Administrator Privileges
• Outdated Software Versions
• Non-hardened Configurations
=> Flaws in System Administration
VZ DBIR Background Info

“We were getting owned through
our users that were running IE with
admin privileges”

• About 5000 seats
• Data Breach
• 6 month security project
• Fully Patched in 2 weeks
• Admin rights controlled
• Whitelisting
• No Additional Software purchased
• No Enduser Impact
DIISRTE
Department of Industry, Innovation, Science, Research and Tertiary Education

Score: Use a letter grade system
or other mechanisms

Targeted Attackers
Disrupt, Slow Down,
Raise Cost, Force Mistakes

US DoS, DIISIRTE,
NASA, DHHS-CMS,
GS, OfficeMax…

• Microsoft Security Intelligence Report v14
• Verizon Data Breach Investigation Report
• Kaspersky Lab – Evaluating the Threat Level of
Software Vulnerabilities
• Symantec – Empirical Study of Zero-day
attacks
• Mandiant Intelligence Center APT1
• South Carolina Data Breach Incident Report
• FireEye Advanced Threat Report
References

SANS Critical Security Controls Summit London 2013

Recommandé

RSA ASIA 2014 - Internet of Things Wolfgang Kandek

Tripwire Energy Working Group: TIV Demo Tripwire

A Smarter, More Secure Internet of Things NetIQ

Advanced Persistent Threat - Evaluating Effective ResponsesNetIQ

Scrubbing Your Active Directory Squeaky CleanNetIQ

Micro segmentation and zero trust for security and compliance - Guardicore an...YouAttestSlideshare

Lisa Guess - Embracing the Cloudcentralohioissa

IT Service & Asset Management Better TogetherIvanti

Recommandé

RSA ASIA 2014 - Internet of Things Wolfgang Kandek

Tripwire Energy Working Group: TIV Demo Tripwire

A Smarter, More Secure Internet of Things NetIQ

Advanced Persistent Threat - Evaluating Effective ResponsesNetIQ

Scrubbing Your Active Directory Squeaky CleanNetIQ

Micro segmentation and zero trust for security and compliance - Guardicore an...YouAttestSlideshare

Lisa Guess - Embracing the Cloudcentralohioissa

IT Service & Asset Management Better TogetherIvanti

Leveraging Identity to Manage Change and ComplexityNetIQ

NTXISSACSC2 - Bring Your Own Device: The Great Debate by Brandon SwainNorth Texas Chapter of the ISSA

Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Oddscentralohioissa

Alex Hanway - Securing the Breach: Using a Holistic Data Protection Frameworkcentralohioissa

Information SecurityMohit8780

Vulnerability Testing Services Case StudyNandita Nityanandam

Reasoning About Enterprise Application Security in a Cloudy WorldElastica Inc.

Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa

Tripwire Energy Working Group: Keynote w/Patrick Miller Tripwire

Shadow Data ExposedElastica Inc.

NIST Zero Trust Explainedrtp2009

Cybersercurity Resource Allocation & Efficacy Index: 2020 - 2021 TrendsIvanti

The Internet of Everything is HereLancope, Inc.

MT 117 Key Innovations in CybersecurityDell EMC World

Two Peas in a Pod: Cloud Security and Mobile Security Omar Khawaja

The Future of Technology OperationsIvanti

Bil Harmer - Myths of Cloud Security Debunked!centralohioissa

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...centralohioissa

#MFSummit2016 Secure: How Security and Identity Analytics can Drive Adaptive ...Micro Focus

Alpha & Omega's Managed SecurityDarryl Santa

20 Critical Security Controls and QualysGuardWolfgang Kandek

Gartner UK 2015 Anatomy of An AttackWolfgang Kandek

Contenu connexe

Tendances

Leveraging Identity to Manage Change and ComplexityNetIQ

NTXISSACSC2 - Bring Your Own Device: The Great Debate by Brandon SwainNorth Texas Chapter of the ISSA

Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Oddscentralohioissa

Alex Hanway - Securing the Breach: Using a Holistic Data Protection Frameworkcentralohioissa

Information SecurityMohit8780

Vulnerability Testing Services Case StudyNandita Nityanandam

Reasoning About Enterprise Application Security in a Cloudy WorldElastica Inc.

Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa

Tripwire Energy Working Group: Keynote w/Patrick Miller Tripwire

Shadow Data ExposedElastica Inc.

NIST Zero Trust Explainedrtp2009

Cybersercurity Resource Allocation & Efficacy Index: 2020 - 2021 TrendsIvanti

The Internet of Everything is HereLancope, Inc.

MT 117 Key Innovations in CybersecurityDell EMC World

Two Peas in a Pod: Cloud Security and Mobile Security Omar Khawaja

The Future of Technology OperationsIvanti

Bil Harmer - Myths of Cloud Security Debunked!centralohioissa

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...centralohioissa

#MFSummit2016 Secure: How Security and Identity Analytics can Drive Adaptive ...Micro Focus

Alpha & Omega's Managed SecurityDarryl Santa

Tendances (20)

Leveraging Identity to Manage Change and Complexity

NTXISSACSC2 - Bring Your Own Device: The Great Debate by Brandon Swain

Jervis Hui - No Tradeoffs: Cloud Security & Privacy Don't Need To Be At Odds

Alex Hanway - Securing the Breach: Using a Holistic Data Protection Framework

Information Security

Vulnerability Testing Services Case Study

Reasoning About Enterprise Application Security in a Cloudy World

Jack Nichelson - Information Security Metrics - Practical Security Metrics

Tripwire Energy Working Group: Keynote w/Patrick Miller

Shadow Data Exposed

NIST Zero Trust Explained

Cybersercurity Resource Allocation & Efficacy Index: 2020 - 2021 Trends

The Internet of Everything is Here

MT 117 Key Innovations in Cybersecurity

Two Peas in a Pod: Cloud Security and Mobile Security

The Future of Technology Operations

Bil Harmer - Myths of Cloud Security Debunked!

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...

#MFSummit2016 Secure: How Security and Identity Analytics can Drive Adaptive ...

Alpha & Omega's Managed Security

En vedette

20 Critical Security Controls and QualysGuardWolfgang Kandek

Gartner UK 2015 Anatomy of An AttackWolfgang Kandek

Using a Network Model to Address SANS Critical Controls 10 and 11Skybox Security

The CIS Critical Security Controls the International Standard for DefenseEnclaveSecurity

MindTheSec Anatomia de um AtaqueWolfgang Kandek

Estadística i pensament crític a la vida diàriaUniversitat de Barcelona

Critical Security Controls v4 1 Mapped to NIST SP 800-53 Rev.4-final r6aJames W. De Rienzo

AWS Security in Plain English – AWS Security Day Amazon Web Services

Ebook: Splunk SANS - CIS Top 20 Critical Security ControlsDominique Dessy

The Critical Security Controls and the StealthWatch SystemLancope, Inc.

Map Critical Security Controls (CSC) v5.0 to NIST SP 800-53 Revision 4 (Summa...James W. De Rienzo

More practical insights on the 20 critical controlsEnclaveSecurity

Phishing attacks, Types Of Phishing Attacks, How To Avoid Phishing Attacks Er. Rahul Jain

Extend Enterprise Application-level Security to Your AWS EnvironmentImperva

How to Spot and Combat a Phishing Attack - Cyber Security Webinar | ControlScanControlScan, Inc.

20 Security Controls for the CloudNetStandard

Networking and communications security – network architecture designEnterpriseGRC Solutions, Inc.

Webinar: 10 steps you can take to protect your business from phishing attacksCyren, Inc

Using an Open Source Threat Model for Prioritized DefenseEnclaveSecurity

Security Attack Analysis for Finding and Stopping Network AttacksSavvius, Inc

En vedette (20)

20 Critical Security Controls and QualysGuard

Gartner UK 2015 Anatomy of An Attack

Using a Network Model to Address SANS Critical Controls 10 and 11

The CIS Critical Security Controls the International Standard for Defense

MindTheSec Anatomia de um Ataque

Estadística i pensament crític a la vida diària

Critical Security Controls v4 1 Mapped to NIST SP 800-53 Rev.4-final r6a

AWS Security in Plain English – AWS Security Day

Ebook: Splunk SANS - CIS Top 20 Critical Security Controls

The Critical Security Controls and the StealthWatch System

Map Critical Security Controls (CSC) v5.0 to NIST SP 800-53 Revision 4 (Summa...

More practical insights on the 20 critical controls

Phishing attacks, Types Of Phishing Attacks, How To Avoid Phishing Attacks

Extend Enterprise Application-level Security to Your AWS Environment

How to Spot and Combat a Phishing Attack - Cyber Security Webinar | ControlScan

20 Security Controls for the Cloud

Networking and communications security – network architecture design

Webinar: 10 steps you can take to protect your business from phishing attacks

Using an Open Source Threat Model for Prioritized Defense

Security Attack Analysis for Finding and Stopping Network Attacks

Similaire à SANS Critical Security Controls Summit London 2013

Protecting health and life science organizations from breaches and ransomwareCloudera, Inc.

Application Hackers Have A Handbook. Why Shouldn't You?London School of Cyber Security

SCADA Security WebinarAVEVA

Using 80 20 rule in application security managementDaveEdwards12

Cloud Security: A Business-Centric Approach in 12 StepsOmar Khawaja

Data Security: What Every Leader Needs to KnowRoger Hagedorn

Advanced threat protection and big dataPeter Wood

Symantec and ForeScout Delivering a Unified Cyber Security SolutionDLT Solutions

AWS Cloud SecurityAmazon Web Services LATAM

Utilizing the Critical Security Controls to Secure Healthcare TechnologyEnclaveSecurity

Sumeet Mandloi: Robust Security Testing FrameworkAnna Royzman

SAM05_Barber PW (7-9-15)Norm Barber

Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...SolarWinds

Customer Spotlight:Deploying a Data Protection Program in less than 120 DaysDigital Guardian

Empowering the business while efficiently mitigating risks - Eva Chen (Trend ...Minh Le

Cyber security: A roadmap to secure solutionsSchneider Electric

Eliminate Silos to Enhance Critical Infrastructure Protection by Jasvir GillTheAnfieldGroup

Government and Education Webinar: How the New Normal Could Improve your IT Op...SolarWinds

Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05 sucesuminas

GDPR Part 2: Quest RelevanceAdrian Dumitrescu

Similaire à SANS Critical Security Controls Summit London 2013 (20)

Protecting health and life science organizations from breaches and ransomware

Application Hackers Have A Handbook. Why Shouldn't You?

SCADA Security Webinar

Using 80 20 rule in application security management

Cloud Security: A Business-Centric Approach in 12 Steps

Data Security: What Every Leader Needs to Know

Advanced threat protection and big data

Symantec and ForeScout Delivering a Unified Cyber Security Solution

AWS Cloud Security

Utilizing the Critical Security Controls to Secure Healthcare Technology

Sumeet Mandloi: Robust Security Testing Framework

SAM05_Barber PW (7-9-15)

Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...

Customer Spotlight:Deploying a Data Protection Program in less than 120 Days

Empowering the business while efficiently mitigating risks - Eva Chen (Trend ...

Cyber security: A roadmap to secure solutions

Eliminate Silos to Enhance Critical Infrastructure Protection by Jasvir Gill

Government and Education Webinar: How the New Normal Could Improve your IT Op...

Segurança da Informação e Estrutura de Redes - Café Empresarial 15/05

GDPR Part 2: Quest Relevance

Plus de Wolfgang Kandek

Anatomie eines AngriffsWolfgang Kandek

RSA USA 2015 - Getting a Jump on HackersWolfgang Kandek

Unsafe SSL webinarWolfgang Kandek

BSI Lagebericht 2014Wolfgang Kandek

Februar Patch Tuesday 2015 WebinarWolfgang Kandek

Patch Summary Webinar February 14Wolfgang Kandek

Patch Summary Webinar April 11 Wolfgang Kandek

Plus de Wolfgang Kandek (7)

Anatomie eines Angriffs

RSA USA 2015 - Getting a Jump on Hackers

Unsafe SSL webinar

BSI Lagebericht 2014

Februar Patch Tuesday 2015 Webinar

Patch Summary Webinar February 14

Patch Summary Webinar April 11

SANS Critical Security Controls Summit London 2013

1. Presenting a Hard Target To Attackers Wolfgang Kandek CTO, Qualys Inc SANS Critical Security Controls 2013 London, May 1, 2013

4. Defense

5. Threat Intelligence

6. Public Threat Intelligence

7. 2012 – Data breaches in the news

8. 2012 – Data breaches in the news

9. 2012 – Data breaches in the news

10. 2013 – started in a similar way

11. 2013 – started in a similar way

12. 2013 – started in a similar way

13. 2013 – started in a similar way

22. Traditional Tools Are Failing

23. Attacker Competence Is Rising

24. Attacker Competence Is Rising

25.

26.

27.

28. 78 %

29. • Open System Administration Channels • Default and Weak Passwords • End-user has Administrator Privileges • Outdated Software Versions • Non-hardened Configurations => Flaws in System Administration VZ DBIR Background Info

30. “We were getting owned through our users that were running IE with admin privileges”

31.

32.

33.

34.

35.

36.

37. 90 %

38.

39. 39

40.

41.

42.

43.

44.

45.

46. 85 %

47. 85 % of past incidents prevented

48. • About 5000 seats • Data Breach • 6 month security project • Fully Patched in 2 weeks • Admin rights controlled • Whitelisting • No Additional Software purchased • No Enduser Impact DIISRTE Department of Industry, Innovation, Science, Research and Tertiary Education

49. 20 %

50. 20 % 327 malwares

51. 20 % 327 malwares 262 bypassed AV

52. 20 % 327 malwares 262 bypassed AV

53. Implementation

54. Implementation

55. Score: Use a letter grade system

56. Score: Use a letter grade system

57. Score: Use a letter grade system or other mechanisms

58. Score: Use a letter grade system

59. Results

60. Opportunistic Attackers

61. Opportunistic Attackers ✔

62. Targeted Attackers

63. Targeted Attackers Disrupt, Slow Down

64. Targeted Attackers Disrupt, Slow Down, Raise Cost, Force Mistakes

65. Information

66. US DoS, DIISIRTE, NASA, DHHS-CMS, GS, OfficeMax…

67.

68.

69. • Microsoft Security Intelligence Report v14 • Verizon Data Breach Investigation Report • Kaspersky Lab – Evaluating the Threat Level of Software Vulnerabilities • Symantec – Empirical Study of Zero-day attacks • Mandiant Intelligence Center APT1 • South Carolina Data Breach Incident Report • FireEye Advanced Threat Report References